Authenticated encryption system, method, device and storage medium

Abstract

The application discloses an authentication encryption system, method, device and storage medium, relates to the technical field of wireless communication, and the authentication encryption method comprises a client terminal device and a network connection module; the network connection module obtains terminal identity and session key structure of the client terminal device to be accessed based on a pre-trained session key prediction model; when receiving a connection request of the client terminal device, the session key of the client terminal device is generated according to the terminal identity and the session key structure; the session key is encrypted, and the encrypted session key obtained through encryption is cached; when receiving a connection request initiated again by the client terminal device, the client terminal device is quickly accessed and authenticated based on the cached encrypted session key. Since the required session key is prepared in advance through the key prediction mechanism, the session key is cached locally, the authentication time is shortened, and the network connection speed is improved.

Description

Technical Field

[0001] This application relates to the field of wireless communication technology, and in particular to authentication and encryption systems, methods, devices and storage media. Background Technology

[0002] WAPI, as a wireless LAN security protocol, employs symmetric encryption mechanisms such as SM1 / SM4 and digital certificate mechanisms, and is widely used in high-security scenarios such as government affairs, energy, power, and the military.

[0003] However, the WAPI authentication process is complex, and authentication latency becomes a significant issue in scenarios involving frequent device roaming, disconnections and reconnections, and AP restarts. This not only degrades the user experience but also impacts network efficiency, failing to meet current high demands for network real-time performance and stability. Currently, most vendors only implement the "standard implementation" of WAPI, lacking intelligent prediction and fast caching mechanisms, making it difficult to improve authentication efficiency while ensuring security. Summary of the Invention

[0004] The main purpose of this application is to provide an authentication encryption system, method, device, and storage medium, which aims to solve the technical problems of high latency and low efficiency in the existing WAPI authentication process.

[0005] To achieve the above objectives, this application proposes an authentication encryption system, the system comprising: a client terminal device and a network connection module;

[0006] The network connection module is used to obtain the terminal identity and session key structure of the client terminal device to be accessed based on a pre-trained session key prediction model.

[0007] The network connection module is further configured to generate a session key for the client terminal device based on the terminal identity and the session key structure when receiving a connection request from the client terminal device.

[0008] The network connection module is also used to encrypt the session key and cache the encrypted session key obtained by encryption;

[0009] The network connection module is further configured to perform fast access authentication on the client terminal device based on the cached encrypted session key when receiving a connection request initiated by the client terminal device again.

[0010] In one embodiment, the network connection module is further configured to encrypt the session key to obtain an encrypted session key;

[0011] The network connection module is also used to cache the encrypted session key locally and set an expiration date and re-authentication window for the encrypted session key.

[0012] In one embodiment, the network connection module is further configured to obtain the encrypted session key in the local cache when receiving a connection request initiated again by the client terminal device;

[0013] The network connection module is also used to determine whether the encrypted session key is valid based on the validity period;

[0014] The network connection module is also used to perform fast access authentication based on the encrypted session key when the encrypted session key is valid.

[0015] In one embodiment, the network connection module is further configured to check whether the encrypted session key is valid when the re-authentication time corresponding to the re-authentication window arrives;

[0016] The network connection module is further configured to delete the encrypted session key from the local cache and renegotiate the key with the client terminal device when the encrypted session key is invalid.

[0017] In one embodiment, the system further includes: a key management module;

[0018] The network connection module is also used to initiate communication requests to the key management module at preset time intervals;

[0019] The key management module is used to communicate with the network connection module based on the communication request;

[0020] The network connection module is further configured to send the key status information in the local cache to the key management module during communication with the key management module. The key status information includes the encryption session key and the association information of the encryption session key.

[0021] The key management module is also used for risk control based on the key status information.

[0022] In one embodiment, the key management module is further configured to monitor data behavior in the network and the authentication strategy of the network connection module based on the association information;

[0023] The key management module is also used to send a renegotiation instruction to the network connection module when the data behavior is abnormal or the authentication policy changes;

[0024] The network connection module is configured to delete the encrypted session key from the local cache and renegotiate the key with the client terminal device when it receives the renegotiation instruction.

[0025] In one embodiment, the client terminal device is used to record connection information;

[0026] The client is also used to send the connection information to the network connection module;

[0027] The network connection module is used to train a session key prediction model based on the connection information.

[0028] Furthermore, to achieve the above objectives, this application also proposes an authentication encryption method, which is used in the authentication encryption system described above, the method comprising:

[0029] The network connection module obtains the terminal identity and session key structure of the client terminal device to be accessed based on a pre-trained session key prediction model.

[0030] When the network connection module receives a connection request from a client terminal device, it generates a session key for the client terminal device based on the terminal identity and the session key structure.

[0031] The network connection module encrypts the session key and caches the encrypted session key.

[0032] When the network connection module receives a connection request initiated by the client terminal device again, it performs fast access authentication on the client terminal device based on the cached encrypted session key.

[0033] In addition, to achieve the above objectives, this application also proposes an authentication encryption device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the authentication encryption method as described above.

[0034] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the authentication and encryption method described above.

[0035] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the authentication and encryption method described above.

[0036] One or more technical solutions proposed in this application have at least the following technical effects:

[0037] The authentication and encryption system of this application includes: a client terminal device and a network connection module; the network connection module obtains the terminal identity and session key structure of the client terminal device to be connected based on a pre-trained session key prediction model; upon receiving a connection request from the client terminal device, it generates a session key for the client terminal device based on the terminal identity and session key structure; it encrypts the session key and caches the encrypted session key; upon receiving a subsequent connection request from the client terminal device, it performs fast access authentication for the client terminal device based on the cached encrypted session key. Because the required session key is prepared in advance through a key prediction mechanism, the authentication time is shortened; simultaneously, by caching the session key locally, fast key recovery is achieved upon reconnection, skipping the cumbersome complete negotiation process, further shortening the authentication time and improving network connection speed. Attached Figure Description

[0038] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a functional module block diagram provided for Embodiment 1 of the authentication encryption system of this application;

[0041] Figure 2 This is a flowchart illustrating Embodiment 2 of the authentication encryption method in this application;

[0042] Figure 3 This is a functional module block diagram provided for Embodiment 3 of the authentication encryption method of this application;

[0043] Figure 4 This is a schematic diagram illustrating the authentication encryption method provided in the embodiments of this application;

[0044] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the authentication encryption method in this application embodiment.

[0045] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0046] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0047] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0048] In this application embodiment, an authentication encryption system is provided, referring to... Figure 1 , Figure 1 This is a functional module block diagram provided for Embodiment 1 of the authentication encryption system of this application.

[0049] like Figure 1 As shown in the embodiment of this application, the authentication encryption system includes: a client terminal device and a network connection module.

[0050] It should be noted that in a WAPI-based wireless communication network, the client terminal device can be a network access terminal node, such as a smartphone, computer, vehicle IoT device, sensor, etc., and this application embodiment does not limit this.

[0051] It should be explained that the aforementioned network connection module is a bridge used in this application embodiment to connect the client terminal device to the wireless communication network, such as a smart access point or a wireless gateway.

[0052] The network connection module is used to obtain the terminal identity and session key structure of the client terminal device to be accessed based on a pre-trained session key prediction model.

[0053] The network connection module is further configured to generate a session key for the client terminal device based on the terminal identity and the session key structure when receiving a connection request from the client terminal device.

[0054] The network connection module is also used to encrypt the session key and cache the encrypted session key obtained by encryption;

[0055] The network connection module is further configured to perform fast access authentication on the client terminal device based on the cached encrypted session key when receiving a connection request initiated by the client terminal device again.

[0056] In this embodiment, the client terminal can record multi-dimensional connection information such as its own terminal identity, connection history, roaming behavior and location information, and key structure. A session key prediction model can be obtained by training based on this multi-dimensional data (i.e., connection information).

[0057] In some embodiments of this application, the connection history may include access time, accessed AP information, etc.; roaming behavior may cover roaming frequency, roaming direction, etc.; location information can be obtained through positioning technology.

[0058] In some embodiments of this application, during key generation, the user's connection frequency, connection mode (such as frequent AP switching, connection time period), and other connection history data can directly affect the selection of the key generation protocol. The user's switching behavior between different APs during roaming will dynamically update the key, and the user's geographical location can affect the selection of the encryption algorithm. When the client successfully connects to the network connection terminal, the client terminal can send the recorded connection information (i.e., multi-dimensional data) to the network connection terminal. Based on this multi-dimensional data, a session key prediction model is trained using machine learning algorithms. That is, the client terminal device is used to record connection information; the client is also used to send the connection information to the network connection module; and the network connection module is used to train the session key prediction model based on the connection information.

[0059] It should be noted that the above-mentioned session key prediction model can be a prediction model pre-trained based on decision tree algorithm, neural network algorithm or other algorithms. The specific training algorithm and training process can be selected based on the needs of actual application, and the embodiments of this application do not limit this.

[0060] Understandably, the session key prediction model enables the key prediction mechanism of the authentication encryption system in this application, allowing for the preparation of the required session keys and key negotiation in advance, thus shortening the time required for authentication access. Combined with the fast key response mechanism upon re-access, the cumbersome complete negotiation process can be skipped, further shortening the authentication time and improving network connection speed.

[0061] It should be noted that the specific process of key negotiation described above can be implemented based on the needs of actual applications, and the embodiments of this application do not impose any restrictions on it.

[0062] It should be explained that the session key prediction model in this application can predict the terminal identity and session key structure of the client terminal device to be connected based on multi-dimensional data, thereby improving authentication efficiency. When the network connection module receives a connection request from the client terminal device, it can generate a session key with the client terminal device based on the terminal identity and session key structure predicted by the session key prediction model.

[0063] It should be noted that the aforementioned session key structure can be a key composition framework that defines the constituent elements, generation method, management strategy, and security mechanism of the session key, and is used to encrypt and protect communication data. Through the session key structure, the key type, key value, key validity period, encryption algorithm identifier, etc., of the client terminal device about to connect can be determined, and then a session key for the client terminal device can be generated based on the terminal identity and the session key structure.

[0064] In some embodiments of this application, the present application also uses an optimized session key caching mechanism to locally encrypt and cache the session key. By locally caching the session key, when the client terminal device accesses the network again, the network connection module can first obtain the MAC address or other identification identifiers that can be used to uniquely identify a client terminal device. By comparing the identification identifier with the identification identifier corresponding to the locally cached session key, if the comparison is successful, the network connection module can directly use the locally cached session key for fast access authentication, skipping the complete key negotiation process.

[0065] In some embodiments of this application, while performing identification tag comparison, it can be checked whether the authentication policy has changed and whether the locally cached session key has expired. If the authentication policy has not changed and the session key has also expired, then fast access authentication can be performed based on the locally cached session key if the comparison passes. The locally cached session key enables rapid key recovery.

[0066] In some embodiments of this application, the authentication and encryption system of this application may further include a key management module, and the network connection module may communicate with the key management module to achieve key state synchronization.

[0067] The authentication and encryption system of this application embodiment includes: a client terminal device and a network connection module; the network connection module obtains the terminal identity and session key structure of the client terminal device to be accessed based on a pre-trained session key prediction model; upon receiving a connection request from the client terminal device, it generates a session key for the client terminal device according to the terminal identity and session key structure; it encrypts the session key and caches the encrypted session key; upon receiving a connection request initiated again by the client terminal device, it performs fast access authentication for the client terminal device based on the cached encrypted session key. Because the required session key is prepared in advance through a key prediction mechanism, the authentication time is shortened; simultaneously, by caching the session key locally, fast key recovery is achieved upon reconnection, skipping the cumbersome complete negotiation process, further shortening the authentication time and improving network connection speed.

[0068] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 , Figure 2 This is a flowchart provided for an embodiment of the authentication encryption system of this application.

[0069] like Figure 2As shown in the embodiment of this application, the network connection module is further used to encrypt the session key to obtain an encrypted session key;

[0070] The network connection module is also used to cache the encrypted session key locally and set an expiration date and re-authentication window for the encrypted session key.

[0071] It should be noted that, in this embodiment, the network connection module can encrypt and store the locally cached session key. The encryption algorithm used can be the SM4 algorithm or other algorithms, and this embodiment does not impose any limitations on this. During data transmission, using the SM4 algorithm to generate a key chain and encrypt the transmitted data can effectively prevent key leakage and man-in-the-middle attacks, ensuring data transmission security.

[0072] Understandably, when obtaining a session key through a session key prediction model, an expiration period and a re-authentication window can be set for that session key. The expiration period is the validity period of the session key; if the session key's lifespan exceeds the expiration period, it can be considered invalid. The re-authentication window is the detection window for re-authenticating the session key. When the re-authentication time corresponding to the re-authentication window is reached, the validity of the session key can be checked based on the expiration period. If it is valid, the system can continue to wait for the client terminal device to reconnect; if it is invalid, the session key in the local cache can be deleted, and a new session key can be renegotiated with the client terminal device.

[0073] It should be understood that since the encrypted session key is obtained by encrypting the session key, it has the same validity period and re-authentication window as the session key. That is, the network connection module is further configured to obtain the encrypted session key from the local cache when receiving a re-initiated connection request from the client terminal device; the network connection module is further configured to determine whether the encrypted session key is valid based on the validity period; the network connection module is further configured to perform fast access authentication based on the encrypted session key when it is valid. The network connection module is further configured to check whether the encrypted session key is valid when the re-authentication time corresponding to the re-authentication window arrives; the network connection module is further configured to delete the encrypted session key from the local cache and renegotiate the key with the client terminal device when the encrypted session key is invalid.

[0074] It should be noted that when the network connection module receives a reconnection request from the client terminal device, it can perform a re-access check on the client terminal device. Specifically, the re-access check process may include: obtaining the identification identifier of the client terminal device based on the connection request, and comparing this identification identifier with the identification identifiers corresponding to each encrypted session key in the local cache; simultaneously checking whether the authentication policy has changed and whether the cached encrypted session key has expired. If the identification identifiers are consistent, the authentication policy remains unchanged, and the session key has not expired, the re-access check is considered successful, and the network connection module can directly use the locally cached session key for fast authentication, skipping the complete key negotiation process; if the identification identifiers are inconsistent and / or the authentication policy has changed and / or the session key has expired, the re-access check is considered unsuccessful, and the session key and related information in the local cache need to be deleted, and the network connection module and the client terminal device need to renegotiate the key. This embodiment of the application balances security and efficiency by locally encrypting and caching the session key and setting an expiration period and a re-authentication window.

[0075] This embodiment encrypts the session key using a network connection module to obtain an encrypted session key. The encrypted session key is then locally cached, and an expiration date and re-authentication window are set for it. Because the session key is locally encrypted and cached, and an expiration date and re-authentication window are set, the entire negotiation process can be skipped under certain conditions, allowing for rapid access authentication using the locally cached session key, significantly improving authentication access efficiency.

[0076] Based on the first and / or second embodiments of this application, in the third embodiment of this application, the content that is the same as or similar to the first and / or second embodiments described above can be referred to the above description and will not be repeated hereafter. Based on this, please refer to... Figure 3 , Figure 3 This is a functional module block diagram provided for Embodiment 3 of the authentication encryption system of this application.

[0077] like Figure 3 As shown in the embodiment of this application, the system further includes a key management module.

[0078] It should be noted that the key management module in this application embodiment can be a functional module that can manage the session keys cached in the network connection module and the associated information of the session keys, such as a key management center or access controller.

[0079] The network connection module is also used to initiate communication requests to the key management module at preset time intervals;

[0080] The key management module is used to communicate with the network connection module based on the communication request;

[0081] The network connection module is further configured to send the key status information in the local cache to the key management module during communication with the key management module. The key status information includes the encryption session key and the association information of the encryption session key.

[0082] The key management module is also used for risk control based on the key status information.

[0083] It should be noted that the above-mentioned preset time can be set based on the needs of actual applications, and this application embodiment does not limit it.

[0084] In this embodiment, the network connection module can periodically communicate with the key management module and synchronize key status information to the key management module. The communication interval is the aforementioned preset time, and the specific value of this preset time can be set according to the actual application, such as one minute, five minutes, etc., and this embodiment does not limit this. By synchronizing the key status information of all client terminals stored in the local cache of the network connection module to the key management module, the key management module can update its own recorded key status database when it receives this information to ensure that it is consistent with the key status of each network connection module, thereby realizing risk control of various data and behaviors in the network (such as data behavior monitoring, authentication policy monitoring, renegotiation command issuance, etc.).

[0085] It should be noted that the aforementioned key status information may include the encrypted session key and related information such as the identification identifier of the client terminal device corresponding to the encrypted session key, authentication policy, network traffic information, key usage frequency information, login location information, etc. This application embodiment does not impose any limitations on this.

[0086] In this embodiment, the key management module can perform security risk detection based on the key status information to determine whether there is abnormal key usage behavior, network attack signs, or whether the user has modified the authentication policy (such as changing the password, adjusting access permissions, etc.). If there is abnormal key usage behavior and / or network attack signs and / or the user has modified the authentication policy, a mandatory renegotiation command can be sent to the network connection module to force the network connection module to renegotiate the session key with the client terminal device, ensuring network security. Specifically, when the network connection module receives the renegotiation command, it can delete the key status information corresponding to the renegotiation command from its local cache and send a renegotiation notification to the client terminal device corresponding to the key status information to renegotiate the session key. That is, the key management module is also used to monitor data behavior in the network and the authentication policy of the network connection module based on the associated information; the key management module is also used to send a renegotiation command to the network connection module when the data behavior is abnormal or the authentication policy changes; the network connection module is used to delete the encrypted session key from its local cache and renegotiate the key with the client terminal device when it receives the renegotiation command.

[0087] It is understood that the aforementioned data behavior detection may include key usage behavior detection, network attack indication detection, etc., and this application embodiment does not limit this. When data behavior is abnormal (such as frequent use of different keys for login within a short period of time, or a large number of access requests from abnormal IP addresses), the network connection module can be forced to perform key renegotiation.

[0088] It should be understood that during the process of renegotiating the session key between the client terminal device and the network connection module, the network connection module can delete the original cached session key. When the new session key is successfully negotiated, the network connection module can obtain the newly generated session key, encrypt it for local caching, and set a new validity period and re-authentication window for subsequent rapid access authentication.

[0089] The system in this embodiment also includes a key management module. The network connection module initiates communication requests to the key management module at preset intervals; the key management module communicates with the network connection module based on these requests; during communication, the network connection module sends locally cached key status information to the key management module, including the encrypted session key and its associated information; the key management module performs risk control based on the key status information. Because the key management module performs security monitoring and risk control on the key status information cached in the network connection module, it can effectively determine whether there is abnormal data or behavior in the network, thereby ensuring network security.

[0090] This application also provides an authentication encryption method, please refer to... Figure 4 , Figure 4 This is a schematic diagram illustrating the workflow of the authentication and encryption method according to an embodiment of this application. The authentication and encryption method is used in the authentication and encryption system described above, and the method includes:

[0091] Step S10: The network connection module obtains the terminal identity and session key structure of the client terminal device to be accessed based on the pre-trained session key prediction model.

[0092] Step S20: When the network connection module receives a connection request from the client terminal device, it generates a session key for the client terminal device based on the terminal identity and the session key structure.

[0093] Step S30: The network connection module encrypts the session key and caches the encrypted session key.

[0094] In step S40, when the network connection module receives a connection request initiated again by the client terminal device, it performs fast access authentication on the client terminal device based on the cached encrypted session key.

[0095] In some embodiments of this application, the network connection module encrypts the session key and caches the encrypted session key, including:

[0096] The network connection module encrypts the session key to obtain an encrypted session key;

[0097] The network connection module caches the encrypted session key locally and sets an expiration period and re-authentication window for the encrypted session key.

[0098] In some embodiments of this application, the method further includes:

[0099] When the network connection module receives a connection request initiated again by the client terminal device, it obtains the encrypted session key from the local cache.

[0100] The network connection module determines whether the encrypted session key is valid based on the validity period;

[0101] When the encrypted session key is valid, the network connection module performs fast access authentication based on the encrypted session key.

[0102] In some embodiments of this application, the system further includes: a key management module; the method further includes:

[0103] The network connection module sends a communication request to the key management module at preset intervals;

[0104] The key management module communicates with the network connection module based on the communication request;

[0105] During communication with the key management module, the network connection module sends the key status information in the local cache to the key management module. The key status information includes the encrypted session key and the associated information of the encrypted session key.

[0106] The key management module performs risk control based on the key status information.

[0107] In some embodiments of this application, the step of the key management module performing risk control based on the key status information includes:

[0108] The key management module monitors data behavior in the network and the authentication policy of the network connection module based on the associated information;

[0109] When the data behavior is abnormal or the authentication policy changes, the key management module sends a renegotiation instruction to the network connection module.

[0110] When the network connection module receives the renegotiation instruction, it deletes the encrypted session key from the local cache and renegotiates the key with the client terminal device.

[0111] In some embodiments of this application, before the step of the network connection module obtaining the terminal identity and session key structure of the client terminal device to be accessed based on the pre-trained session key prediction model, the method further includes:

[0112] The client terminal device records connection information;

[0113] The client sends the connection information to the network connection module;

[0114] The network connection module trains a session key prediction model based on the connection information.

[0115] The authentication encryption method provided in this application, employing the authentication encryption method in the above embodiments, can solve the technical problems of high latency and low authentication efficiency in the existing WAPI authentication process. Compared with the prior art, the beneficial effects of the authentication encryption method provided in this application are the same as those of the authentication encryption method provided in the above embodiments, and other technical features in the authentication encryption method are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0116] This application provides an authentication encryption device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the authentication encryption method in Embodiment 1 above.

[0117] The following is for reference. Figure 5 The diagram illustrates a structural schematic suitable for implementing the authentication and encryption device in the embodiments of this application. The authentication and encryption device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The authentication encryption device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0118] like Figure 5 As shown, the authentication and encryption device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the authentication and encryption device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the authentication and encryption device to communicate wirelessly or wiredly with other devices to exchange data. While the figures show authentication and encryption devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0119] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0120] The authentication encryption device provided in this application, employing the authentication encryption method described in the above embodiments, can solve the technical problems of high latency and low efficiency in the existing WAPI authentication process. Compared with the prior art, the beneficial effects of the authentication encryption device provided in this application are the same as those of the authentication encryption method provided in the above embodiments, and other technical features in this authentication encryption device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0121] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0122] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0123] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the authentication encryption method in the above embodiments.

[0124] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0125] The aforementioned computer-readable storage medium may be included in the authentication and encryption device; or it may exist independently and not be assembled into the authentication and encryption device.

[0126] The aforementioned computer-readable storage medium carries one or more programs that, when executed by the authentication encryption device, cause the authentication encryption device to:

[0127] The network connection module obtains the terminal identity and session key structure of the client terminal device to be accessed based on a pre-trained session key prediction model.

[0128] When the network connection module receives a connection request from a client terminal device, it generates a session key for the client terminal device based on the terminal identity and the session key structure.

[0129] The network connection module encrypts the session key and caches the encrypted session key.

[0130] When the network connection module receives a connection request initiated again by the client terminal device, it performs fast access authentication on the client terminal device based on the cached encrypted session key. Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer through any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0131] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0132] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0133] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described authentication encryption method. This solves the technical problems of high latency and low efficiency in existing WAPI authentication processes. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the authentication encryption method provided in the above embodiments, and will not be repeated here.

[0134] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the authentication and encryption method described above.

[0135] The computer program product provided in this application can solve the technical problems of high latency and low efficiency in the existing WAPI authentication process. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the authentication encryption method provided in the above embodiments, and will not be repeated here.

[0136] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. An authenticated encryption system, characterized by The system comprises a client terminal device and a network connection module; The network connection module is configured to obtain a terminal identity and a session key structure of the client terminal device to be accessed based on a pre-trained session key prediction model; the session key structure defines constituent elements, generation methods, management strategies, and security mechanisms of the session key; The network connection module is further configured to generate a session key of the client terminal device according to the terminal identity and the session key structure when receiving a connection request of the client terminal device; The network connection module is further configured to encrypt the session key and cache an encrypted session key obtained by the encryption; The network connection module is further configured to perform quick access authentication on the client terminal device based on the cached encrypted session key when receiving a connection request initiated again by the client terminal device; The network connection module is further configured to encrypt the session key to obtain an encrypted session key; The network connection module is further configured to locally cache the encrypted session key and set an effective period and a re-authentication window for the encrypted session key; The system further comprises a key management module; The network connection module is further configured to initiate a communication request to the key management module every preset time interval; The key management module is configured to communicate with the network connection module based on the communication request; The network connection module is further configured to send key state information in the local cache to the key management module in the communication process with the key management module, wherein the key state information comprises the encrypted session key and associated information of the encrypted session key; The key management module is further configured to perform risk control based on the key state information; The key management module is further configured to monitor data behaviors in the network and authentication strategies of the network connection module based on the associated information; The key management module is further configured to send a re-negotiation instruction to the network connection module when the data behaviors are abnormal or the authentication strategies change; The network connection module is configured to delete the encrypted session key in the local cache and re-negotiate a key with the client terminal device when receiving the re-negotiation instruction.

2. The authenticated encryption system of claim 1, wherein, The network connection module is further configured to obtain the encrypted session key in the local cache when receiving a connection request initiated again by the client terminal device; The network connection module is further configured to determine whether the encrypted session key is valid based on the effective period; The network connection module is further configured to perform quick access authentication based on the encrypted session key when the encrypted session key is valid.

3. The authenticated encryption system of claim 1, wherein, The network connection module is further configured to check whether the encrypted session key is valid when a re-authentication time corresponding to the re-authentication window arrives; The network connection module is further configured to delete the encrypted session key in the local cache and re-negotiate a key with the client terminal device when the encrypted session key is invalid.

4. The authenticated encryption system of claim 1, wherein, The client terminal device is configured to record connection information; The client is further configured to send the connection information to the network connection module. The network connection module is configured to train a session key prediction model based on the connection information.

5. An authentication encryption method characterized by, The authentication encryption method is used in the authentication encryption system of any one of claims 1-4, and the method comprises: The network connection module obtains a terminal identity and a session key structure of a client terminal device to be accessed based on the pre-trained session key prediction model; the session key structure defines constituent elements, generation mode, management policy, and security mechanism of the session key; The network connection module generates a session key of the client terminal device according to the terminal identity and the session key structure when receiving a connection request of the client terminal device; The network connection module encrypts the session key and caches the encrypted session key obtained by encryption; The network connection module performs quick access authentication on the client terminal device based on the cached encrypted session key when receiving a connection request initiated again by the client terminal device; The network connection module encrypts the session key to obtain an encrypted session key; The network connection module locally caches the encrypted session key and sets an effective period and a re-authentication window for the encrypted session key; The system further comprises a key management module, and the method further comprises: The network connection module initiates a communication request to the key management module every preset time interval; The key management module communicates with the network connection module based on the communication request; In the communication process with the key management module, the network connection module sends key state information in the local cache to the key management module, and the key state information comprises the encrypted session key and associated information of the encrypted session key; The key management module performs risk control based on the key state information; The step of performing risk control based on the key state information by the key management module comprises: The key management module monitors data behaviors in the network and authentication strategies of the network connection module based on the associated information; The key management module sends a re-negotiation instruction to the network connection module when the data behaviors are abnormal or the authentication strategies change; The network connection module deletes the encrypted session key in the local cache and re-negotiates the key with the client terminal device when receiving the re-negotiation instruction. The device comprises a memory, a processor, and an authentication encryption program stored on the memory and executable on the processor, and the authentication encryption program is configured to implement the steps of the authentication encryption method of claim 5.

6. An authentication encryption device characterized by comprising: The storage medium stores an authentication encryption program, and the authentication encryption program is executed by the processor to implement the steps of the authentication encryption method of claim 5.

7. A storage medium, characterized by ​

Images